ESP32 + Termux + USB OTG

Wi-Fi capture
without root.

NRSuite turns a $3 ESP32 into a monitor-mode adapter for Termux. No rooted phone. No custom kernel. No expensive hardware. Just a cheap chip, an OTG cable, and a stock Android phone.

Get started View on GitHub
Termux — nrsuite
~$3 Hardware cost
0 Root required
13 Wi-Fi channels
Any. Android phone

Capabilities

What it does

The ESP32 handles everything at the radio layer. Termux talks to it over USB CDC — no root, no kernel modules, no custom ROM required.

scan
Wi-Fi network scan
Active scan returning SSID, BSSID, channel, RSSI, and security type for all visible networks.
capture
Packet capture
Fixed channel or channel-hopping promiscuous capture. Output as .pcap with radiotap headers — Wireshark-compatible.
eapol
Handshake capture
Passive EAPOL capture, optionally filtered by BSSID. No association required — fully passive.
deauth
Deauth + capture
Send deauthentication frames to trigger a reconnect, then capture the EAPOL handshake simultaneously.
live
Live streaming
Pipe pcap output to termshark via named FIFO for real-time frame analysis on the phone itself.
protocol
Binary bridge protocol
Compact framed protocol with sliding-window flow control over USB CDC bulk transfer. Not serial ASCII.

Setup

Up and running in minutes

Works on any stock Android phone with a USB OTG port. No root. No custom ROM. No kernel modules.

01
Install Termux dependencies
Install Termux from F-Droid, then add the Termux:API companion app. Run pkg install python termux-api libusb and pip install pyusb.
02
Flash the ESP32 firmware
Build with PlatformIO or grab a pre-built binary from the Releases page. Flash to an ESP32-C3 SuperMini — the primary tested board.
03
Connect via OTG and run
Plug the ESP32 into your phone with a data-capable OTG cable. Grant the USB permission dialog on first use. Run ./nrsuite scan.
# Clone the repo git clone https://github.com/7wp81x/NRSuite cd NRSuite # Install Termux deps pkg install python termux-api libusb pip install pyusb # Flash firmware (PlatformIO) cd firmware/ pio run -e esp32-c3-supermini --target upload cd .. # Make executable and scan chmod +x nrsuite ./nrsuite scan

Or use the automated installer:
curl -sSL https://raw.githubusercontent.com/7wp81x/NRSuite/main/install.sh | bash

Hardware

What you need

All supported ESP32 variants use native USB CDC — no external USB-UART bridge chip required. They appear as 303A:xxxx on Android.

Tested
ESP32-C3 SuperMini
Primary target. ~$3 on AliExpress. Native USB CDC built-in. VID:PID 303A:1001. Single-core RISC-V, 400 KB SRAM.
Tested
ESP32-S3
More RAM and flash, native USB CDC, dual-core Xtensa. Should work with minor platformio.ini adjustments.
Untested
ESP32-S2
Single-core, native USB CDC, lower cost. VID:PID 303A:0002. Should work with minor platformio.ini adjustments.
Required
USB OTG cable + Android phone
Any Android phone with USB host support. Use a data-capable OTG cable — charge-only cables will not work. No root required.

Bridge Protocol

A compact binary frame, not serial ASCII

Termux and the ESP32 talk over USB CDC bulk transfer using a fixed binary frame with sliding-window flow control — fast enough for live pcap streaming.

Sync0xAD 0xDE
Type1B
ID1B
Length4B LE
PayloadN bytes
Type Direction Payload
CMD 0x01 Termux → ESP32 JSON command + args
RESP 0x02 ESP32 → Termux JSON response, matched by ID
EVENT 0x03 ESP32 → Termux Async JSON — scan results, heartbeat
PCAP 0x04 ESP32 → Termux Raw radiotap header + 802.11 frame
ACK 0x05 Termux → ESP32 Chunk acknowledgment — flow control

Roadmap

What's next

NRSuite's modular CMD dispatcher is built to grow. These are the modules planned for upcoming releases.

AP mode — captive portal support
Beacon broadcasting — beacon spam, custom and hidden SSIDs
WPS support — WPS Pixie Dust attack
WPA3 PMKID capture — passive, no deauth required
Bluetooth — BLE scanning, advertising, device discovery, BLE spam
HID emulation — BLE BadUSB, keyboard injection
Multi-ESP32 — USB hub + multiple devices for simultaneous multi-channel capture
Hardware expansion — IR, NRF24, CC1101 modules

Comparison

How it stacks up

The no-root path is the unique capability. It turns any stock Android phone into a Wi-Fi capture platform with zero setup beyond Termux and a $5 chip.

NRSuite (no root) NRSuite (root) NetHunter + ext. adapter
Root required No Yes Yes
Custom kernel / ROM No No Yes
Hardware cost ~$5 ~$5 $150–400+
Supported Android devices Any Any NetHunter-supported only
Monitor mode Yes Yes Yes
Packet injection Yes Yes Yes
Live Wireshark via FIFO Yes Yes Yes
IR / RF expansion Planned Planned No